Don’t use corporate email for your personal life

TL;DR People use whatever is convenient. Segregation of work and personal matters is a key part of security. Using corporate addresses tramples on this separation. Corporate email addresses should be treated with the same care as sensitive corporate information. Create an Acceptable Use Policy th...

UBUNTU-CVE-2025-22011

In the Linux kernel, the following vulnerability has been resolved: ARM: dts: bcm2711: Fix xHCI power-domain During s2idle tests on the Raspberry CM4 the VPU firmware always crashes on xHCI power-domain resume: root@raspberrypi:/sys/power echo freeze state 70.724347 xhcisuspend finished 70.727730...

CVE-2024-11071 Improper Access Control In DestinyECM

Permissive Cross-domain Policy with Untrusted Domains vulnerability in local API server of DestinyECM solutionversions described below which is developed and maintained by Cyberdigm may allow Cross-Site Request Forgery CSRF attack, which probabilistically enables JSON Hijacking aka JavaScript...

CVE-2024-11071

CVE-2024-11071 concerns DestinyECM by Cyberdigm. The issue is a Permissive Cross-domain Policy with Untrusted Domains in the local API server, which may allow Cross-Site Request Forgery (CSRF) and probabilistically enable JSON Hijacking via forged pages. The base description notes version differe...

Ubuntu 24.04 LTS : Linux kernel (Low Latency) vulnerabilities (USN-7381-1)

"The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7381-1 advisory. Attila Szsz discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a...

MAL-2025-2802 Malicious code in web-commerce-hook (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3db0dcb1f890e4ce0fdf79bcdd216d419d1bdcefb1cac333858a78b0d7efa3ca The OpenSSF Package Analysis project identified 'web-commerce-hook' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

USN-7380-1 linux-lowlatency vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - MIPS architecture; - PowerPC architecture; - RISC-V architecture; - S390 architecture; - x86...

Origin Validation Error

Prefect is vulnerable to Origin Validation Error. The vulnerability is due to improper access control due to unauthorized domains being allowed to access sensitive data, leading to potential data leaks, loss of confidentiality, service disruption, and data integrity risks...

Branch History Leak

AMD ID: AMD-SB-7026 Potential Impact: N/A Severity: N/A Summary Researchers from The Harbin Institute of Technology have shared with AMD a paper titled “Branch History LeakeR: Leveraging Branch History to Construct a New Side Channel-Theory and Practice” that demonstrates a side channel attack...

Researchers Uncover ~200 Unique C2 Domains Linked to Raspberry Robin Access Broker

A new investigation has unearthed nearly 200 unique command-and-control C2 domains associated with a malware called Raspberry Robin. "Raspberry Robin also known as Roshtyak or Storm-0856 is a complex and evolving threat actor that provides initial access broker IAB services to numerous criminal...

Medium: python

Issue Overview: An issue was found in the CPython zipfile module affecting versions 3.12.2, 3.11.8, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerable to "quoted-overlap" zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed...

GHSA-WXPC-2674-RXVW Feast Cross-Origin Resource Sharing vulnerability

A Cross-Origin Resource Sharing CORS vulnerability exists in feast-dev/feast version 0.40.0. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API. This can bypass intended security...

CVE-2024-11602

CVE-2024-11602 affects feast-dev/feast v0.40.0. The CORS configuration on the agentscope server does not restrict access to trusted origins, allowing requests from any external domain. This can bypass security controls and potentially expose sensitive information. The provided documents do not sp...

PT-2025-12222

Name of the Vulnerable Software and Affected Versions prefecthq/prefect version 2.20.2 Description A CORS Cross-Origin Resource Sharing misconfiguration allows unauthorized domains to access sensitive data, potentially leading to unauthorized access to the database. This can result in data leaks,...

MAL-2025-2344 Malicious code in mocha-dast-reporter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 09f8297f30739d5810d9dfb46db787d2d403256217f71cbd9b85c5e8671ff8f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2340 Malicious code in notification-center-admin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3608296b1021343f3245e75793f59483ee9c78f0aa41ca662756286d02d348a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2068 Malicious code in unms-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9afdcd693808bda70843549fdd063575a29fdfeb78fd1baabc86e74b3cfb868d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2062 Malicious code in learning-kotlin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5560da3fe5e63bf7da20ae1cd458fd7999e279367f07227ce8a6019ca497dc87 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Linux Distros Unpatched Vulnerability : CVE-2021-28713

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rogue backends can cause DoS of guests via high frequency events This CNA information record relates to multiple CVEs; the text explains which...

Linux Distros Unpatched Vulnerability : CVE-2021-28711

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rogue backends can cause DoS of guests via high frequency events This CNA information record relates to multiple CVEs; the text explains which...